Repository navigation
chore(release): 5.62.1 - #1786
Merged
Merged
Conversation
A 5.x hotfix release cut from 5.62.x. Folds 15 changelog fragments into a dated 5.62.1 section (13 fixed, 2 security) and bumps the version in edgar/__about__.py and server.json. The kd2ap entry is reworded at assembly for 5.x: the client that mounted the proxy in front of the cache and rate limiter is httpx here, not httpx2. Security: lxml>=6.1.3 plus one XML parser that loads no external resource (edgartools-o6y3i, LP#2165901); certifi>=2026.10.19, which drops the compromised emSign root (edgartools-a9bak). test-fast green in clean uv venvs with httpx only (no httpx2): Python 3.12 8635 passed, 9 skipped, 1 xfailed; Python 3.10 8634 passed, 10 skipped, 1 xfailed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…chanism The two Security entries now say what changed and that upgrading is recommended (lxml>=6.1.3 plus stricter XML parsing; certifi>=2026.10.19 dropping the distrusted emSign roots), without detailing how the issues could be reached. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 tasks done
dgunning
added a commit
that referenced
this pull request
Oct 23, 2026
Brings the 5.62.1 release record from 5.62.x (9f2ff38, #1786) onto main: the dated 5.62.1 CHANGELOG section, verbatim; the version in edgar/__about__.py and server.json; and deletes the 14 changelog fragments 5.62.1 released, each byte-identical on main. a9bak-certifi-floor was 5.x-only and never on main; main's own emSign fragment (#1647) stays for 6.0. 89 fragments remain for 6.0. test-fast green: 47412 passed, 9 skipped, 1 xfailed. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Releases 5.62.1 from the
5.62.xhotfix branch: two security fixes and 13 wrong-value fixes backported in #1673 and #1764. Folds 15 changelog fragments into a dated## [5.62.1] - 2026-10-22section and bumps the version inedgar/__about__.pyandserver.json(all three strings).Security
Fixed (#1673):
configure_http(proxy=...)keeps the rate limiter and cache; bank and EntityFacts revenue totals (JPMorgan FY2025 $182.4B, GM $185,019M, U.S. Bancorp $28,656M); Oracle decrease rows; fourto_markdown()table fixes; BDC coupon-suffixed loans; N-PORT securities lending;EightKdashed item headers;search_filingssingle date bound; instant-only notes.One entry is reworded at assembly: the kd2ap line names httpx, not httpx2, since 5.x runs on httpx.
Verification
assemble_changelog.py --checkpassed; 15 fragments folded and deleted.pytest -m fast: Python 3.12 8,635 passed, 0 failed; Python 3.10 8,634 passed, 0 failed (the extra skip is atomllibtest that skips on 3.10 by design).lxml>=6.1.3andcertifi>=2026.10.19, and passes the XML hardening check under both lxml 6.1.3 and 6.1.0.get_http_config()["proxy"]checked offline on this branch with a fake proxy URL: reported for bothHTTPS_PROXYandconfigure_http(proxy=...), as the kd2ap entry says.AI assistance
🤖 Generated with Claude Code